Skip to contentSkip to conversation

touchscreen/bu21013_ts: null dereference in error handling

PATCH Superseded Dan Carpenter 2 participants 3 messages Oct 27, 2010

Subsystems (3)
Kernel janitors HID Input drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 touchscreen/bu21013_ts: null dereference in error handling

If kzalloc() returned NULL then it would lead to a NULL deref after the goto.

Signed-off-by Dan Carpenter <[email protected]>
drivers/input/touchscreen/bu21013_ts.c +6 -2
index ccde586..8f120b1 100644
@@ -446,11 +446,14 @@ static int __devinit bu21013_probe(struct i2c_client *client,
 	}
 
 	bu21013_data = kzalloc(sizeof(struct bu21013_ts_data), GFP_KERNEL);
+	if (!bu21013_data)
+		return -ENOMEM;
+
 	in_dev = input_allocate_device();
-	if (!bu21013_data || !in_dev) {
+	if (!in_dev) {
 		dev_err(&client->dev, "device memory alloc failed\n");
 		error = -ENOMEM;
-		goto err_free_mem;
+		goto err_free;
 	}
 
 	bu21013_data->in_dev = in_dev;

@@ -515,6 +518,7 @@ err_cs_disable:
 	pdata->cs_dis(pdata->cs_pin);
 err_free_mem:
 	input_free_device(bu21013_data->in_dev);
+err_free:
 	kfree(bu21013_data);
 
 	return error;
maintainer
#1 lore raw

Re: [patch] touchscreen/bu21013_ts: null dereference in error

Hi Dan,

Quoted 4 lines · Dan Carpenter

If kzalloc() returned NULL then it would lead to a NULL deref after the goto.

Signed-off-by Dan Carpenter <[email protected]>

Just changing the error path to do input_free_device(in_dev); is much simpler.

Quoted 30 lines
drivers/input/touchscreen/bu21013_ts.c +6 -2
index ccde586..8f120b1 100644
@@ -446,11 +446,14 @@ static int __devinit bu21013_probe(struct i2c_client *client,
 	}
 
 	bu21013_data = kzalloc(sizeof(struct bu21013_ts_data), GFP_KERNEL);
+	if (!bu21013_data)
+		return -ENOMEM;
+
 	in_dev = input_allocate_device();
-	if (!bu21013_data || !in_dev) {
+	if (!in_dev) {
 		dev_err(&client->dev, "device memory alloc failed\n");
 		error = -ENOMEM;
-		goto err_free_mem;
+		goto err_free;
 	}
 
 	bu21013_data->in_dev = in_dev;

@@ -515,6 +518,7 @@ err_cs_disable:
 	pdata->cs_dis(pdata->cs_pin);
 err_free_mem:
 	input_free_device(bu21013_data->in_dev);
+err_free:
 	kfree(bu21013_data);
 
 	return error;
Signature · 1 line
Dmitry
author
#2 lore raw

PATCH v2 1/1 touchscreen/bu21013_ts: null dereference in error

In the original code "bu21013_data" could be NULL here.

Signed-off-by Dan Carpenter <[email protected]>

---
V2: same thing; different approach.

drivers/input/touchscreen/bu21013_ts.c +1 -1
index ccde586..2ca9e5d 100644
@@ -514,7 +514,7 @@ err_free_irq:
 err_cs_disable:
 	pdata->cs_dis(pdata->cs_pin);
 err_free_mem:
-	input_free_device(bu21013_data->in_dev);
+	input_free_device(in_dev);
 	kfree(bu21013_data);
 
 	return error;